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Data Protection Act 


Introduction 


The Data Protection Act 1998 (the DPA) is based around eight 
principles of good information handling. These give people specific 
rights in relation to their personal information and place certain 
obligations on those organisations that are responsible for 
processing it. 


An overview of the main provisions of the DPA can be found in The 
Guide to Data Protection. 


This is part of a series of guidance, which goes into more detail than 
the Guide, to help data controllers to fully understand their 
obligations and promote good practice. 


This guidance is aimed at Local Education Authorities and those 
working within schools, colleges and universities. It gives advice on 
taking photographs in educational institutions and whether doing so 
must comply with the DPA. 


Recommended good practice 


The DPA is unlikely to apply in many cases where photographs are 
taken in schools and other educational institutions. Fear of 
breaching the provisions of the DPA should not be wrongly used to 
stop people taking photographs or videos which provide many with 
much pleasure. 


Where the DPA does apply, a common sense approach suggests 
that if the photographer asks for permission to take a photograph, 
this will usually be enough to ensure compliance. 


e Photos taken for official school use may be covered by the 
DPA and pupils and students should be advised why they are 
being taken. 
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Photos taken purely for personal use are exempt from the 
DPA. 


Examples 


Personal use: 


A parent takes a photograph of their child and some friends 
taking part in the school Sports Day to be put in the family 
photo album. These images are for personal use and the DPA 
does not apply. 


Grandparents are invited to the school nativity play and wish 
to video it. These images are for personal use and the DPA 
does not apply. 


Official school use: 


Photographs of pupils or students are taken for building 
passes. These images are likely to be stored electronically 
with other personal data and the terms of the DPA will apply. 


A small group of pupils are photographed during a science 
lesson and the photo is to be used in the school prospectus. 
This will be personal data but will not breach the DPA as long 
as the children and/or their guardians are aware this is 
happening and the context in which the photo will be used. 


Media use: 


A photograph is taken by a local newspaper of a school 
awards ceremony. As long as the school has agreed to this, 
and the children and/or their guardians are aware that 
photographs of those attending the ceremony may appear in 
the newspaper, this will not breach the DPA. 


More information 


Additional guidance is available on our guidance pages if you need 
further information on other parts of the DPA. 
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This guidance has been developed drawing on ICO experience. 
Because of this it may provide more detail on issues that are often 
referred to the Information Commissioner than on those we rarely 
see. The guidance will be reviewed and considered from time to 
time in line with new decisions of the Information Commissioner, 
Tribunals and courts. 


It is a guide to our general recommended approach, although 
individual cases will always be decided on the basis of their 
particular circumstances. 


If you need any more information about this or any other aspect of 
data protection, please contact us, or visit our website at 
www.ico.org.uk. 
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